Information processing device, information processing method, and computer program

Abstract

This will allow us to prevent the sharing of past data with external parties when the user has not consented to sharing their data with external parties. [Solution] The information processing device installed in the vehicle includes a data storage control unit 334 that stores consent period information in the vehicle storage unit 32 regarding the period during which the vehicle user consented to the provision of data acquired in the vehicle to external parties, and a transmission control unit 335 that controls the transmission of data previously acquired in the vehicle to a server based on whether the user consented to the provision of data to external parties at the time the data was acquired, by referring to the consent period information.

Description

Technical Field

[0006] , ,

[0001] The present disclosure relates to an information processing apparatus, an information processing method, and a computer program.

Background Art

[0002] Conventionally, regarding providing data acquired during driving by a vehicle to an external device, when the driver gives consent, the data is transmitted to the external device, and when the driver does not give consent, the data is not transmitted to the external device (Patent Document 1).

[0003] In particular, in the information processing apparatus described in Patent Document 1, for each driver and each data type, whether consent regarding data transmission is given or not is stored in the storage unit of the vehicle, and only the data for which consent is given is transmitted to the external device.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] By the way, in the information processing apparatus described in Patent Document 1, for each driver and each data type, whether current consent regarding data transmission is given or not is stored. Therefore, once the driver gives consent, all the data acquired in the past can be provided to the external device. That is, even if there is a period during which the driver has not consented to data provision, there is a possibility that the data acquired during that period will also be provided to the external device.

[0006] In view of the above problems, an object of the present disclosure is to be able to prevent past data from being provided externally when the user has not consented to providing the data externally. [Means for solving the problem]

[0007] The gist of this disclosure is as follows:

[0008] (1) An information processing device mounted on a vehicle, A storage control unit that stores consent period information regarding the period during which the user of the vehicle consented to the provision of data acquired in the vehicle to an external party in the vehicle's storage unit, An information processing device comprising: a transmission control unit that controls the transmission of data previously acquired in the vehicle to an external device based on whether the user consented to the provision of the data to an external party at the time the data was acquired, by referring to the consent period information. (2) The information processing apparatus according to (1) above, wherein the memory control unit stores the acquired data in the memory unit together with data representing the time the data was acquired each time data is acquired in the vehicle. (3) The information processing apparatus according to (1) or (2) above, wherein the transmission control unit controls the transmission of previously acquired data to the external device when a data provision condition to the external device is met that is different from the condition when the data was acquired. (4) The information processing apparatus according to (3) above, wherein the transmission control unit controls the transmission of data previously acquired in the vehicle to the external device based on whether the user consented to the provision of the data to an external party at the time the data was acquired, and whether the user of the vehicle consented to the provision of the data to an external party when the conditions for providing the data to the external device are met. (5) The information processing apparatus according to any one of (1) to (4) above, wherein the transmission control unit determines, by referring to the consent period information, that the user of the vehicle did not consent to the provision of the data to an external device at the time the data was acquired, and the transmission control unit does not transmit regulatory data, which is at least a part of the data, to the external device. (6) The information processing apparatus according to any one of (1) to (4) above, wherein the transmission control unit determines, by referring to the consent period information, that the user of the vehicle had not consented to the provision of the data to an external party at the time the data was acquired, and transmits the regulatory data, which is at least a part of the data, to the external device after processing it to reduce the accuracy of the information. (7) The information processing apparatus according to (5) or (6) above, wherein the transmission control unit determines, by referring to the consent period information, that the user of the vehicle had consented to the provision of the data to an external device at the time the data was acquired, and transmits the data, including the regulatory data, to the external device. (8) The information processing device according to (5) or (6) above, wherein the transmission control unit determines, by referring to the consent period information, that the user of the vehicle had consented to the provision of the data to an external device at the time the data was acquired, but the consent information at the time of provision, which indicates whether the user of the vehicle has consented to the provision of the data to an external device when different data provision conditions to the external device are met than when the data was acquired, indicates that the user of the vehicle has not consented to the provision of the data to an external device. (9) The information processing device according to (5) or (6) above, wherein the transmission control unit determines, by referring to the consent period information, that the user of the vehicle had consented to the provision of the data to an external device at the time the data was acquired, but the consent information at the time of provision, which indicates whether the user of the vehicle has consented to the provision of the data to an external device when different data provision conditions to the external device are met than when the data was acquired, indicates that the user of the vehicle has not consented to the provision of the data to an external device, then the information processing device according to (5) or (6) above, which processes the restricted data to reduce the accuracy of the information and transmits it to the external device. (10) The information processing apparatus according to (8) or (9) above, wherein the transmission control unit determines, by referring to the consent period information, that the user of the vehicle consented to the provision of the data to an external device at the time the data was acquired, and the consent information at the time of provision indicates that the user of the vehicle consented to the provision of the data to an external device, then transmits the data, including the regulatory data, to the external device. (11) The information processing apparatus described in (6) or (9) above, wherein the processing that reduces the accuracy of the information includes the processing of anonymizing the privacy information contained in the regulated data. (12) The information processing device according to any one of (5) to (11) above, wherein the regulatory data includes the privacy information of the user of the vehicle or a person who was around the vehicle at the time the data was acquired. (13) The information processing device according to any one of (1) to (12) above, further comprising a consent information management unit for managing consent information indicating whether or not the user of the vehicle consents to the provision of data to an external party. (14) The information processing apparatus according to any one of (3), (4), and (8) to (10) above, wherein the data provision conditions include conditions that are met when a data read request is received from the external device. (15) The data provision conditions include conditions that are met periodically, as described in any one of (3), (4), (8) to (10) and (14) above. (16) The information processing device described in any one of (3), (4), (8) to (10), (14) and (15) above, wherein the data provision conditions include conditions that are met when a predetermined incident occurs in the vehicle. (17) Information processing methods performed in a vehicle, The vehicle's memory unit is used to store consent period information regarding the period during which the user of the vehicle consented to the provision of data acquired in the vehicle to external parties. An information processing method comprising controlling the transmission of data previously acquired in the vehicle to an external device based on whether the user consented to the provision of the data to an external party at the time the data was acquired, by referring to the consent period information. (18) A computer program executed in a vehicle, comprising: causing a storage unit of the vehicle to store consent period information regarding a period during which a user of the vehicle has consented to the external provision of data acquired in the vehicle; controlling, in the vehicle, the transmission of data acquired in the past to an external device based on whether the user has consented to the external provision of the data at the time when the data was acquired, by referring to the consent period information; and causing a computer to execute the program.

Effect of the Invention

[0009] According to the present disclosure, it is possible not to provide past data when the user has not consented to the external provision of the data.

Brief Description of the Drawings

[0010] [Figure 1] FIG. 1 is a schematic configuration diagram of a data collection system. [Figure 2] FIG. 2 is a schematic configuration diagram of a vehicle. [Figure 3] FIG. 3 is a configuration diagram showing the configuration of an ECU. [Figure 4] FIG. 4 is an example of consent period information stored in a vehicle storage unit by a consent information storage control unit. [Figure 5] FIG. 5 is a diagram showing an example of accumulated data stored in a vehicle storage unit by a data storage control unit. [Figure 6] FIG. 6 is a configuration diagram showing the configuration of a server. [Figure 7] FIG. 7 is a flowchart showing the flow of consent information storage processing. [Figure 8] FIG. 8 is a flowchart showing the flow of data storage processing. [Figure 9] FIG. 9 is a flowchart showing the flow of transmission processing. [Figure 10]FIG. 10 is a flowchart similar to FIG. 9 showing the flow of transmission processing according to a modified example. [Figure 11] FIG. 11 is a diagram similar to FIG. 5 showing an example of the accumulated data stored in the vehicle storage unit by the data storage control unit in the second embodiment. [Figure 12] FIG. 12 is a flowchart similar to FIG. 9 showing the flow of transmission processing according to the second embodiment.

Embodiments for Carrying Out the Invention

[0011] Hereinafter, embodiments will be described in detail with reference to the drawings. In the following description, the same reference numerals are assigned to similar components.

[0012] First Embodiment <Configuration of Data Collection System> First, referring to FIG. 1, the configuration of the data collection system 1 according to the first embodiment will be described. FIG. 1 is a schematic configuration diagram of the data collection system 1 according to the first embodiment. The data collection system 1 collects the data acquired in the vehicle 2 to the server 5.

[0013] As shown in FIG. 1, the data collection system 1 includes a plurality of vehicles 2 capable of communication and a server 5. The server 5 is an example of an external device provided outside the vehicle 2. Each of the plurality of vehicles 2 and the server 5 are configured to be able to communicate with each other via a communication network 6 composed of an optical communication line or the like and a radio base station 7 connected to the communication network 6 via a gateway (not shown). As the communication between the vehicle 2 and the radio base station 7, various wide-area wireless communications with a long communication distance can be used. Specifically, as such communication, for example, communication conforming to any communication standard such as 4G, LTE, 5G, WiMAX, etc. established by 3GPP, IEEE (both are registered trademarks) is used.

[0014] In this embodiment, the data collection system 1 collects data from a large number of vehicles 2 while each vehicle 2 is in motion. The collected data is used as big data to provide various services. Specifically, the collected data can be used, for example, as training data for autonomous driving or to analyze the driving of a large number of vehicles 2.

[0015] <Vehicle Configuration> Next, with reference to Figure 2, the configuration of Vehicle 2 will be described. Each Vehicle 2 may be a vehicle operated manually by a driver, a vehicle in which driving assistance can be provided by the ECU of Vehicle 2, or a vehicle in which autonomous driving is performed by the ECU of Vehicle 2.

[0016] In this embodiment, when any incident occurs, vehicle 2 stores data detected by its sensors and transmits at least a portion of the stored data to server 5 based on a request from server 5. Alternatively, vehicle 2 may transmit at least a portion of the stored data to server 5 periodically, rather than at the request of server 5.

[0017] Figure 2 is a schematic diagram of the vehicle 2. In this embodiment, the vehicle 2 has a plurality of sensors 10, a human-machine interface (hereinafter referred to as "HMI") 20, an external communication module 25, and an electronic control unit (hereinafter referred to as "ECU") 30. These components of the vehicle 2 are connected to each other in a way that allows communication, for example, via an in-vehicle network 26 that conforms to a standard such as CAN (Controller Area Network), or they are connected directly via signal lines.

[0018] Sensor 10 detects various types of information related to the vehicle 2 (including information related to the occupants of the vehicle 2, and information related to the environment or conditions surrounding the vehicle 2) and generates corresponding data. Sensor 10 includes, for example, an exterior camera 11, an interior camera 12, a distance measuring sensor 13, a positioning sensor 14, a microphone 15, a driving state sensor 16, and a driver operation sensor 17.

[0019] The exterior camera 11 is a sensor that captures images of the area around the vehicle 2 and generates data representing the image of the area around the vehicle 2. In this embodiment, the exterior camera 11 captures images of the area in front of the vehicle 2. The interior camera 12 is a sensor that captures images of the interior of the vehicle 2 and generates data representing the image of the interior of the vehicle 2. In this embodiment, the interior camera 12 captures images of the user of the vehicle 2 (the occupants of the vehicle 2, especially the driver). The distance measuring sensor 13 is a sensor that measures the distance to objects present around the vehicle 2, especially objects present in front of the vehicle 2, and generates data representing the distance to such objects. The distance measuring sensor 13 is, for example, a radar such as a millimeter-wave radar, a LiDAR, or a sonar.

[0020] The positioning sensor 14 is a sensor that measures the vehicle's own position and generates data representing the vehicle's own position. The positioning sensor 14 is, for example, a GNSS receiver. The microphone 15 is a sensor that detects sound and generates data representing the sound. The microphone 15 detects sound from inside or outside the vehicle 2.

[0021] The driving state sensor 16 is a sensor that detects the driving state of the vehicle 2 and generates data representing the driving state. The driving state sensor 16 detects, for example, the speed, acceleration, and yaw rate (rate of change of yaw angle during turning) of the vehicle 2. The driver operation sensor 17 is a sensor that detects the operation status of the vehicle 2's controls (for example, the accelerator pedal, brake pedal, and steering wheel) by the driver and generates data representing the operation status of the controls. The driver operation sensor 17 includes, for example, an accelerator sensor that detects the amount the accelerator pedal is pressed, a brake sensor that detects the amount the brake pedal is pressed, and a steering sensor that detects the steering angle of the steering wheel.

[0022] Each sensor 10 generates data at predetermined intervals and outputs the generated data to the ECU 30 at predetermined intervals via the in-vehicle network 26. In this way, various data is acquired in vehicle 2 by the sensors 10.

[0023] Furthermore, sensor 10 may include other sensors that detect various types of information related to vehicle 2. For example, sensor 10 may include a grip sensor that detects whether or not the driver is gripping the steering wheel, a rotational speed sensor that detects the rotational speed of the prime mover (engine or electric motor), an air pressure sensor that detects the air pressure of the vehicle 2's tires, and a wheel speed sensor that detects the speed of the vehicle 2's wheels.

[0024] The HMI 20 is a user interface for information exchange between the ECU 30 of the vehicle 2 and the passengers of the vehicle 2. The HMI 20 includes an input device 21 for receiving inputs from the passengers of the vehicle 2 and an output device 22 for notifying the passengers of the vehicle 2. The input device 21 is a device that receives physical or voice operations by the passengers as inputs, and includes at least one of, for example, a touch panel, a switch, a button, a microphone 15, etc. On the other hand, the output device 22 is a device that notifies the passengers through the five senses of the passengers (for example, vision, hearing, touch, etc.), and includes at least one of, for example, display devices (for example, liquid crystal displays, head-up displays, warning lights, etc.), speakers, vibration units, etc.

[0025] The HMI 20 transmits the input data received from the passengers via the input device 21 to the ECU 30 via the in-vehicle network 26. Also, the HMI 20 notifies the passengers via the output device 22 of the information corresponding to the signal received from the ECU 30 via the in-vehicle network 26.

[0026] The out-vehicle communication module 25 communicates with out-vehicle devices. The out-vehicle communication module 25 is a device that wirelessly communicates with the radio base station 7 in accordance with a predetermined mobile communication standard. For example, the out-vehicle communication module 25 transmits the data generated by each of the sensors 10 of the vehicle 2 to the server 5 via the radio base station 7. Also, the out-vehicle communication module 25 receives the data (for example, a data read request signal described later) transmitted from the server 5 via the radio base station 7 and transmits it to the ECU 30.

[0027] <Configuration of ECU> Next, the configuration and operation of the ECU 30 will be described with reference to Figure 3. Figure 3 is a configuration diagram showing the configuration of the ECU 30. The ECU 30 is an example of an information processing device mounted on the vehicle 2. In this embodiment, it controls the transmission of data generated by the vehicle 2's sensor 10 to the server 5. In the example shown in Figures 2 and 3, the vehicle 2 is equipped with one ECU 30, but it may be equipped with multiple ECUs separated by function. As shown in Figure 3, the ECU 30 has a communication interface 31, a vehicle storage unit 32, and a vehicle processor 33. Note that the communication interface 31, the vehicle storage unit 32, and the vehicle processor 33 may be separate circuits, or they may be configured as a single integrated circuit.

[0028] The communication interface 31 has a circuit for connecting the ECU 30 to the in-vehicle network 26, etc. The communication interface 31 transmits signals received from the input devices 21 of the sensor 10 and HMI 20 to the vehicle processor 33. The communication interface 31 also transmits signals received from the vehicle processor 33 to the external communication module 25 and the output devices 22 of the HMI 20.

[0029] The vehicle storage unit 32 is a device for storing data and is a non-temporary storage medium. The vehicle storage unit 32 includes, for example, at least one of volatile semiconductor memory (e.g., RAM), non-volatile semiconductor memory (e.g., ROM), a hard disk drive (HDD), and a solid-state drive (SSD). The vehicle storage unit 32 stores computer programs executed by the vehicle processor 33. The vehicle storage unit 32 also stores various types of data, such as data containing identification information of the vehicle 2 and data received from the sensor 10.

[0030] The vehicle processor 33 has one or more CPUs (Central Processing Units) and their peripheral circuits. The vehicle processor 33 may further have other arithmetic circuits such as a logic unit, a numerical unit, or a graphics processing unit. The vehicle processor 33 executes computer programs stored in the vehicle storage unit 32.

[0031] As shown in Figure 3, the vehicle processor 33 comprises a driver identification unit 331, a consent information management unit 332, a consent information storage control unit 333, a data storage control unit 334, and a transmission control unit 335. Each of these units of the vehicle processor 33 is a functional module realized, for example, by a computer program running on the vehicle processor 33. Alternatively, each unit of the vehicle processor 33 may be implemented in the ECU 30 as an independent integrated circuit, microprocessor, or firmware.

[0032] ≪Driver Identification Section≫ The driver identification unit 331 identifies the user of vehicle 2, particularly the driver of vehicle 2. In this embodiment, the driver identification unit 331 identifies the driver based on images generated by the in-vehicle camera 12, especially images of the driver. Specifically, the driver identification unit 331 extracts feature quantities about the current driver by inputting, for example, an image of the driver into an encoder. If the distance between the feature quantities extracted in this way and the feature quantities extracted from previously captured images of the driver is less than or equal to a certain distance, the driver identification unit 331 identifies the two drivers as the same person.

[0033] When the driver identification unit 331 identifies the driver of vehicle 2, it transmits information about the current driver of the identified vehicle 2 to the consent information management unit 332.

[0034] ≪Consent Information Management Department≫ The consent information management unit 332 manages consent information indicating whether the user of vehicle 2 currently consents to the provision of data acquired in vehicle 2 during its use to external parties. By managing the consent information of the user of vehicle 2 in this way, it is possible to appropriately understand whether the user consents to the provision of data to external parties.

[0035] The consent information management unit 332, at any time, will ask the user of vehicle 2, via the output device 22 of the HMI 20, whether or not they consent to the provision of data to an external party. Such an inquiry may be made, for example, by displaying the inquiry on the display device of vehicle 2, or by outputting an audio message representing the inquiry from the speaker. The consent information management unit 332 will make such an inquiry, for example, when vehicle 2 is started (for example, when the ignition switch is turned ON) or when a driver is seated in the driver's seat of vehicle 2. The consent information management unit 332 may also make such an inquiry at other times, for example, when any incident occurs.

[0036] Furthermore, the consent information management unit 332 receives consent information from the user of vehicle 2 regarding whether or not they consent to the provision of data to external parties. The user inputs the consent information via the input device 21 of the HMI 20. For example, the user inputs the consent information by operating a touch panel or button in response to an inquiry displayed on the display device of vehicle 2. Alternatively, the user inputs the consent information by operating the input device at a time unrelated to any inquiry to the user.

[0037] The consent information management unit 332 retains the consent information entered by the user of vehicle 2. Therefore, if the user of vehicle 2 enters an input indicating consent to the provision of data to an external party, the unit retains the information indicating consent. Subsequently, if the user of vehicle 2 enters an input indicating that they do not consent to the provision of data to an external party, the unit retains the information indicating that they do not consent.

[0038] In particular, in this embodiment, the consent information management unit 332 stores the input consent information for each user. Specifically, the consent information management unit 332 stores consent information for each driver identified by the driver identification unit 331. However, the consent information management unit 332 may store the input consent information independently of the user. In this case, the consent information management unit 332 queries whether or not the user consents to providing the data to an external party each time the user changes. Also, in this case, the vehicle processor 33 does not need to include the driver identification unit 331.

[0039] In addition, the consent information management unit 332 periodically transmits the consent information it holds to the consent information storage control unit 333. In particular, in this embodiment, the consent information management unit 332 transmits the consent information it holds for the current driver identified by the driver identification unit 331 to the consent information storage control unit 333. Alternatively, when the consent information management unit 332 receives a consent information request signal from the consent information storage control unit 333, it may transmit the consent information it holds for the current driver identified by the driver identification unit 331 to the consent information storage control unit 333.

[0040] <<Consent Information Storage and Control Unit>> The consent information storage control unit 333 stores consent period information in the vehicle storage unit 32 regarding the period during which the user of vehicle 2 consented to the provision of data acquired in vehicle 2 to external parties. In particular, the consent information storage control unit 333 stores consent period information in the vehicle storage unit 32 based on the user-specific consent information received from the consent information management unit 332.

[0041] In particular, in this embodiment, the consent information storage control unit 333 records the change in consent status as synchronization period information whenever the consent status of the user of vehicle 2 changes. For example, when the consent information of the user of vehicle 2 received from the consent information management unit 332 changes from information indicating consent to information indicating non-consent, or vice versa, the consent information storage control unit 333 records the change in consent status as synchronization period information in the vehicle storage unit 32. Furthermore, for example, when the user of vehicle 2 changes from a user whose consent information held by the consent information management unit 332 indicates consent to a user whose consent information held by the consent information management unit 332 indicates non-consent, or vice versa, the consent information storage control unit 333 causes the vehicle storage unit 32 to store the change in consent status as consent period information.

[0042] Figure 4 shows an example of consent period information stored in the vehicle storage unit 32 by the consent information storage control unit 333. As shown in Figure 4, in this embodiment, the consent period information includes the time and the change in the consent status. This makes it possible to understand from the consent period information the period during which the user of vehicle 2 consented to the provision of data acquired in vehicle 2 to external parties and the period during which they did not consent.

[0043] Furthermore, the consent period information may be stored in any manner as long as it allows us to understand the period during which the user of Vehicle 2 consented to the provision of data acquired in Vehicle 2 to external parties and the period during which they did not consent. Therefore, the consent period information may include, for example, the start and end times of the period during which the user of Vehicle 2 consented to the provision of data acquired in Vehicle 2 to external parties, and the start and end times of the period during which the user of Vehicle 2 did not consent to the provision of data acquired in Vehicle 2 to external parties.

[0044] ≪Data Storage Control Unit≫ The data storage control unit 334 controls the storage of data acquired in the vehicle 2 into the vehicle storage unit 32. In this embodiment, the data storage control unit 334 controls which data generated by the vehicle 2's sensor 10 is to be stored in the vehicle storage unit 32.

[0045] In this embodiment, when a predetermined incident occurs, the data storage control unit 334 stores the data generated by the sensor 10 before and after the incident in the vehicle storage unit 32. A predetermined incident includes, for example, sudden acceleration exceeding a predetermined acceleration, sudden braking exceeding a predetermined braking force, sudden steering exceeding a predetermined steering speed, a sudden change in the driver's physical condition, the cancellation of the driver assistance system when driver assistance is provided by the vehicle 2, and the pressing of the SOS switch when the vehicle 2 is equipped with an SOS switch. In addition to these situations, or in place of these situations, the predetermined incident may also include other situations.

[0046] Therefore, when the driving state sensor 16 detects an acceleration of the vehicle 2 that is greater than a predetermined acceleration, the data storage control unit 334 stores the data generated by the sensor 10 before and after the detection of such acceleration in the vehicle storage unit 32. By storing data in the vehicle storage unit 32 only when a specific incident occurs, it is possible to obtain the necessary data while keeping the amount of data stored in the vehicle storage unit 32 small.

[0047] In particular, in this embodiment, when a predetermined incident occurs, the data storage control unit 334 stores in the vehicle storage unit 32 data representing images generated by the external camera 11 and the internal camera 12, data representing the vehicle's own position generated by the positioning sensor 14, and data representing audio generated by the microphone 15, before and after the incident. In addition, each time a predetermined incident occurs, the data storage control unit 334 stores in the vehicle storage unit 32 data including identification information of the vehicle 2.

[0048] In addition, in this embodiment, when a predetermined incident occurs, the data storage control unit 334 stores in the vehicle storage unit 32 data representing the driving state generated by the driving state sensor 16 and data representing the operation status of the control device generated by the driver operation sensor 17, both before and after the incident occurred.

[0049] Furthermore, in this embodiment, the data storage control unit 334 stores in the vehicle storage unit 32 data representing the time when the data was acquired, in addition to the data acquired in the vehicle 2. This allows the transmission control unit 335 to determine whether or not the user consented to each piece of data acquired in the past at the time the data was acquired.

[0050] Figure 5 shows an example of stored data stored in the vehicle storage unit 32 by the data storage control unit 334. As shown in Figure 5, various data acquired before and after an incident occurs are stored linked to a single data ID. For example, in the example shown in Figure 5, the stored data with data ID 1 includes data generated by various sensors 10 when the driving state sensor 16 detects a sudden steering maneuver exceeding a predetermined steering speed.

[0051] As shown in Figure 5, one stored data set includes data containing vehicle identification information (identification data), image data, self-position data, and driving status data. In addition, one stored data set includes other data acquired by sensor 10, such as voice data and data indicating the operation status of the control device. Furthermore, one stored data set includes data indicating the time the data was acquired.

[0052] In the above embodiment, the data storage control unit 334 stores data generated by the sensor 10 before and after an incident in the vehicle storage unit 32 when a predetermined incident occurs. However, the data storage control unit 334 may store data generated by the sensor 10 in the vehicle storage unit 32 regardless of an incident. For example, the data storage control unit 334 may always store data generated by the sensor 10 in the vehicle storage unit 32, or it may store data generated by the sensor 10 in the vehicle storage unit 32 when any predetermined condition is met.

[0053] ≪Transmission Control Unit≫ The transmission control unit 335 controls the transmission of data previously acquired in the vehicle 2 to the server 5. Specifically, in this embodiment, the transmission control unit 335 controls the transmission of data generated by the sensor 10 in the vehicle 2 and stored in the vehicle storage unit 32 to the server 5.

[0054] In this embodiment, the transmission control unit 335 refers to the consent period information stored in the vehicle storage unit 32 by the consent information storage control unit 333 and controls the transmission of the data to the server 5 based on whether the user of vehicle 2 (driver or occupant) consented to the provision of the data to the outside of vehicle 2 at the time the data was acquired in vehicle 2. By controlling the transmission to the server 5 based on whether the user consented to the provision of the data to the outside at the time the data was acquired, the provision of past data to the outside when the user did not consent to the provision of the data to the outside is suppressed. Furthermore, if past data to the outside of vehicle 2 when the user did not consent to the provision of the data to the outside is provided, the user will prohibit the provision of all past data to the outside of vehicle 2 in order to prevent the provision of past data. However, by controlling the transmission to the server 5 based on the consent status at the time the data was acquired, the user will be prevented from prohibiting the provision of all past data to the outside of vehicle 2 even when the user is willing to provide some of the past data to the outside of vehicle 2.

[0055] In particular, in this embodiment, if the transmission control unit 335 determines that the user of vehicle 2 had not consented to the provision of the data to an external party at the time the data was acquired by referring to the consent period information, it will not send the restrictive data, which is part of that data, to the server 5. Therefore, in this embodiment, in such a case, the transmission control unit 335 will send the data other than the restrictive data to the server 5. On the other hand, if the transmission control unit 335 determines that the user of vehicle 2 had consented to the provision of the data to an external party at the time the data was acquired by referring to the consent period information, it will send all of that data (including the restrictive data) to the server 5.

[0056] In this embodiment, the regulatory data is data that includes the privacy information of the user of vehicle 2 or people who were around vehicle 2 at the time the data was acquired. On the other hand, in this embodiment, data other than the regulatory data is data that does not include such privacy information.

[0057] Therefore, the regulatory data includes, for example, data containing identification information of vehicle 2 (e.g., vehicle identification number (VIN)). The data containing identification information of vehicle 2 is stored in the vehicle storage unit 32 at the time of manufacture or registration of vehicle 2. The regulatory data also includes, for example, data representing images captured by the exterior camera 11 and the interior camera 12. This is because the image data from the exterior camera 11 contains privacy information of the user of vehicle 2 and people around vehicle 2, and the image data captured by the interior camera 12 contains privacy information of the user of vehicle 2.

[0058] Furthermore, in this embodiment, the regulatory data includes data representing the user's own position measured by the positioning sensor 14. This is because the data representing the user's own position indicates the user's activity history in vehicle 2 and therefore contains private information. In addition, in this embodiment, the regulatory data includes data representing the voice detected by the microphone 15. This is because the data detected by the microphone 15 contains private information of the user in vehicle 2.

[0059] On the other hand, in this embodiment, the regulatory data does not include data representing the driving status of vehicle 2 detected by the driving status sensor 16. This is because data representing the driving status of vehicle 2 is not data that can lead to the identification of an individual, and therefore does not include the privacy information of the vehicle 2 user. In addition, the regulatory data does not include data representing the operation status of the control devices detected by the driver operation sensor 17. This is because data representing the operation status of the control devices is not data that can lead to the identification of an individual, and therefore does not include the privacy information of the vehicle 2 user. Furthermore, in this embodiment, the regulatory data does not include data representing the distance to surrounding objects detected by the distance measuring sensor 13. This is because data representing distance is not data that can lead to the identification of an individual, and therefore does not include the privacy information of the vehicle 2 user and people who were around vehicle 2.

[0060] In this embodiment, if the user of vehicle 2 has not consented to the provision of data to an external party at the time the data is acquired, the restricted data from that data will not be sent to server 5. However, if the user of vehicle 2 has consented to the provision of data to an external party, all of that data will be sent to server 5. This prevents the provision of restricted data from past data when the user has not consented to the provision of data to an external party from being provided to an external party. In addition, since past data including restricted data is provided when the user has consented to the provision of data to an external party, unnecessary restrictions on the provision of data to an external party are prevented. In particular, in this embodiment, if the user of vehicle 2 has not consented to the provision of data to an external party, the transmission of restricted data including privacy information is stopped. This prevents the provision of privacy information to server 5 without the user's consent.

[0061] In this embodiment, the restricted data is data containing privacy information, while data other than the restricted data does not contain privacy information. However, the restricted data may be data with a higher level of privacy than a predetermined level. Therefore, for example, data containing the identification information of vehicle 2 and data representing images may be treated as restricted data, while data representing the vehicle's own position may not be treated as restricted data. In any case, the restricted data includes at least one of the following: data containing the identification information of vehicle 2, data representing images generated by the external camera 11 and the internal camera 12, data representing the vehicle's own position generated by the positioning sensor 14, and data representing sound generated by the microphone 15. Furthermore, the restricted data does not include at least one of the multiple data representing the driving status of vehicle 2 or the multiple data representing the operating status of the control device.

[0062] Alternatively, regulatory data may be data selected independently of privacy information. Furthermore, all data detected by the vehicle 2's sensor 10 may be treated as regulatory data.

[0063] In addition, in this embodiment, the transmission control unit 335 controls the transmission of previously acquired data to the server 5 when the conditions for providing data to the server 5 are met. In this embodiment, for data that the user of vehicle 2 did not consent to providing to an external party at the time of data acquisition, the transmission control unit 335 transmits only the data other than the restricted data to the server 5 when the conditions for providing data to the server 5 are met, without transmitting the restricted data to the server 5. On the other hand, for data that indicates the user of vehicle 2 consented to providing data to an external party at the time of data acquisition, the transmission control unit 335 transmits all of that data (including the restricted data) to the server 5 when the conditions for providing data to the server 5 are met.

[0064] Here, the data provision conditions are conditions that are met at a different time than when the data is acquired. Specifically, in this embodiment, the data provision conditions include a condition that is met when a data read request signal is received from the server 5. In this case, each time the transmission control unit 335 receives a data read request signal from the server 5, it controls the transmission of previously acquired data to the server 5.

[0065] In this embodiment, data is provided to the external system when any data provision conditions are met. Therefore, data is transmitted in batches after a certain amount of data has been stored in the vehicle storage unit 32 of vehicle 2. As a result, server 5 receives the data in batches, making it easier for server 5 to organize the data. In particular, in this embodiment, data is transmitted when a data read request signal is received from server 5, so server 5 can control the timing of data transmission from vehicle 2.

[0066] Furthermore, the data provision conditions may include, in addition to, conditions that are met when a data read request signal is received from the server 5, or alternatively, conditions that are met periodically. In this case, the data provision conditions are met, for example, at regular time intervals or at regular distances traveled, and therefore the transmission control unit 335 controls the transmission of previously acquired data to the server 5 at regular time intervals or at regular distances traveled. In this way, even without receiving a data read request signal from the server 5, it is possible to suppress the excessive accumulation of data in the vehicle storage unit 32 by periodically transmitting data to the server 5.

[0067] Furthermore, the data provision conditions may include, in addition to, or in lieu of, the conditions that are met when a data read request signal is received from the server 5, and in addition to, or in lieu of, the conditions that are met periodically, a condition that is met when a predetermined incident occurs in the vehicle 2. A predetermined incident, as described above, includes, for example, a sudden acceleration exceeding a predetermined acceleration. In this case, the data provision condition is met, for example, when the driving state sensor 16 detects an acceleration of the vehicle 2 that exceeds a predetermined acceleration, and therefore the transmission control unit 335 controls the transmission to the server 5 of previously acquired data (for example, data acquired before and after the detection of an acceleration of the vehicle 2 that exceeds a predetermined acceleration) after the detection of an acceleration of the vehicle 2 that exceeds a predetermined acceleration (for example, after a predetermined time). By transmitting data each time an incident occurs in this way, the data required by the server 5 can be quickly provided to the server 5.

[0068] Please note that the data provision conditions described above are merely examples. Therefore, the data provision conditions may be met at a different time than those described above.

[0069] <Server Configuration> Next, the configuration of server 5 will be described with reference to Figure 6. Figure 6 is a configuration diagram showing the configuration of server 5. Server 5 receives data acquired from multiple vehicles 2 that can communicate via the communication network 6. Server 5 then uses the data received in this way as training data for autonomous driving or to analyze the driving of a large number of vehicles 2.

[0070] In this embodiment, the server 5 comprises an external communication module 51, a server storage unit 52, and a server processor 53. The external communication module 51 and the server storage unit 52 are connected to the server processor 53 via signal lines. The server 5 may further include input devices such as a keyboard and mouse, and output devices such as a display and speakers. The server 5 may also be composed of multiple computers.

[0071] The external communication module 51 communicates with devices outside the server 5. The external communication module 51 has an interface circuit for connecting the server 5 to the communication network 6. The external communication module 51 is configured to communicate with the vehicle 2 via the communication network 6 and the wireless base station 7.

[0072] The server storage unit 52 is a device for storing data and is a non-temporary storage medium. The server storage unit 52 has at least one of the following: volatile semiconductor memory, non-volatile semiconductor memory, HDD, or SSD. The server storage unit 52 stores computer programs executed by the server processor 53. In addition, the server storage unit 52 stores data received from the vehicle 2.

[0073] The server processor 53 has one or more CPUs and their peripheral circuits. The server processor 53 may further have other arithmetic circuits such as a logic unit, a numerical unit, or a graphics processing unit. The server processor 53 executes computer programs stored in the server storage unit 52.

[0074] As shown in Figure 6, the server processor 53 comprises a data request unit 531 and a server storage control unit 532. Each of these components of the server processor 53 is a functional module realized, for example, by a computer program running on the server processor 53.

[0075] The data request unit 531 transmits a data read request signal to each vehicle 2 at any time. For example, the data request unit 531 transmits a data read request signal to each vehicle 2 periodically (for example, at regular time intervals). Alternatively, for example, the data request unit 531 transmits a data read request signal to a vehicle 2 when it receives a signal indicating that an incident has occurred from that vehicle 2. In this case, the ECU 30 of each vehicle 2 transmits a signal to the server 5 indicating that an incident has occurred when a predetermined incident occurs. Alternatively, for example, the data request unit 531 transmits a data read request signal to each vehicle 2 when an analyst operates the input device of the server 5, such as when an analyst needs data to perform an analysis on the operation of the vehicle 2.

[0076] In this embodiment, the data read request signal includes information about the type of data to be read. For example, the data read request signal includes information indicating that data related to a specific incident is being requested. Therefore, for example, the data request unit 531 transmits a data read request signal when an emergency braking incident occurs. In this case, the transmission control unit 335 of the vehicle 2 transmits stored data with data IDs 2 and 3 to the server 5, for example, in the example shown in Figure 5, but does not transmit stored data with data ID 1 to the server 5.

[0077] The server storage control unit 532 controls the storage of data from the server 5 to the server storage unit 52. In this embodiment, when the server storage control unit 532 receives data generated by the sensors 10 from each vehicle 2, it stores the received data in the server storage unit 52. This data stored in the server storage unit 52 is used as training data for autonomous driving or to analyze the operation of multiple vehicles 2.

[0078] <Processing flow> Next, with reference to Figures 7 to 9, the processing flow executed by the vehicle processor 33 will be explained. First, the consent information storage process, which stores consent period information in the vehicle storage unit 32, will be explained. Figure 7 is a flowchart showing the flow of the consent information storage process. The consent information storage process shown in Figure 7 is executed by the vehicle processor 33 at regular time intervals.

[0079] As shown in Figure 7, in the consent information storage process, first, the consent information storage control unit 333 determines whether or not the consent status of the user of vehicle 2 has changed (step S11). As described above, the change in the consent status of the user of vehicle 2 is determined based on the consent information of the user of vehicle 2 received from the consent information management unit 332. If it is determined in step S11 that the user's consent status has not changed, the consent information storage process is terminated. On the other hand, if it is determined in step S11 that the user's consent status has changed, the vehicle storage unit 32 is instructed to store the change in consent status and the time of the change as consent period information (step S12). As a result, the vehicle storage unit 32 stores consent period information as shown in Figure 4.

[0080] Next, we will explain the data storage process in which data generated by the vehicle 2's sensor 10 is stored in the vehicle storage unit 32. Figure 8 is a flowchart showing the flow of the data storage process. The storage process shown in Figure 8 is executed by the vehicle processor 33 at regular time intervals.

[0081] As shown in Figure 8, in the data storage process, first, the data storage control unit 334 determines whether a predetermined incident has occurred based on, for example, the speed, acceleration, and steering angle change rate of the vehicle 2 detected by the driving state sensor 16 (step S21). If it is determined in step S21 that no predetermined incident has occurred, the data storage process is terminated.

[0082] On the other hand, if it is determined in step S21 that a predetermined incident has occurred, the data storage control unit 334 acquires the data generated by each of the sensors 10 and the current time (step S22). The data storage control unit 334 may also acquire data generated by the sensors 10 in step S22 in addition to the data currently being generated by the sensors 10, by temporarily storing the data generated by the sensors 10 in the vehicle storage unit 32 for a certain period of time.

[0083] Next, the data storage control unit 334 stores the data acquired in step S22 and the current time as a single stored data in the vehicle storage unit 32 (step S23). As a result, the vehicle storage unit 32 stores the stored data as shown in Figure 5.

[0084] Next, we will explain the transmission process for sending data acquired in vehicle 2 to server 5. Figure 9 is a flowchart showing the flow of the transmission process. The transmission process shown in Figure 9 is executed by the vehicle processor 33 at regular time intervals.

[0085] As shown in Figure 9, in the transmission process, the transmission control unit 335 first determines whether the data provision conditions are met (step S31). As described above, the data provision conditions are met, for example, when a data read request signal is received from the server 5. If it is determined in step S31 that the data provision conditions are not met, the transmission process is terminated.

[0086] On the other hand, if it is determined in step S31 that the data provision conditions are met, the transmission control unit 335 identifies the data to be read (step S32). For example, if the data read request signal received from the server 5 requests the reading of data related to an emergency braking incident, the data related to the emergency braking incident is identified as the data to be read.

[0087] Next, the target data is sent to the server. Steps S33 to S35 are performed for each of the multiple specific data identified in step S32.

[0088] First, the transmission control unit 335 determines whether the user had consented to the provision of data to an external party at the time the data was acquired for one of the multiple specific data identified in step S32 (step S33). Specifically, the transmission control unit 335 determines whether the user had consented based on the time included in the corresponding specific data and the consent period information stored in the vehicle storage unit 32. For example, in the examples shown in Figures 4 and 5, the stored data with data ID 2 was acquired during a period when the consent status was not consented, so it is determined that the user had not consented to the provision of data to an external party at the time the stored data was acquired. On the other hand, the stored data with data ID 3 was acquired during a period when the consent status was consented, so it is determined that the user had consented to the provision of data to an external party at the time the stored data was acquired.

[0089] If it is determined in step S33 that the user has consented, the transmission control unit 335 sends all of the corresponding specific data (including the regulatory data) to the server 5 (step S34). On the other hand, if it is determined in step S33 that the user has not consented, the transmission control unit 335 sends the data other than the regulatory data from the corresponding specific data to the server (step S35). After that, once the processing in steps S33 to S35 has been performed for all of the multiple specific data identified in step S32, the transmission process is terminated. Note that in step S35, the transmission control unit 335 sends the data other than the regulatory data from the corresponding specific data to the server, but it is not necessary to send any of the corresponding specific data to the server.

[0090] <Variation> Next, a modified version of the first embodiment will be described with reference to Figure 10. In the first embodiment described above, if the transmission control unit 335 determines that the user of vehicle 2 did not consent to the provision of data to an external party at the time the data was acquired by referring to the consent period information, it transmits data other than the restricted data from the data previously acquired by vehicle 2, without transmitting the restricted data.

[0091] In contrast, in this modified version, if the transmission control unit 335 determines that the user of vehicle 2 did not consent to the provision of data to an external party at the time the data was acquired by referring to the consent period information, it transmits the restricted data to the server 5 after processing it to reduce the accuracy of the information, and transmits data other than the restricted data to the server 5 without processing it.

[0092] Processing that reduces the accuracy of information includes processes that anonymize private information contained in regulated data. For example, processing that reduces the accuracy of information includes processes that reduce the resolution of images or apply mosaics to images of characters or people so that the characters on license plates or people in the images cannot be identified. Processing that reduces the accuracy of information also includes processes that reduce the resolution of images or apply mosaics to images of occupants so that occupants in the images cannot be identified. Processing that reduces the accuracy of information also includes processes that process the audio data generated by the microphone 15 so that the occupant who spoke cannot be identified. In addition, processing that reduces the accuracy of information includes processes that broaden the range in which the vehicle 2 may be located so that the specific location cannot be identified in the data representing its own position generated by the positioning sensor 14.

[0093] By processing the information in this way to reduce its accuracy before sending it to server 5, it is possible to provide the minimum necessary data used for analyzing the driving of vehicle 2, etc., while protecting the privacy of users who have not consented to the provision of their data to external parties.

[0094] Figure 10 is a flowchart similar to Figure 9, showing the flow of the transmission process according to this modified example. Steps S41 to S44 in Figure 10 are the same as steps S31 to S34 in Figure 9, so their explanation is omitted.

[0095] If it is determined in step S43 that the user did not consent, the transmission control unit 335 processes the restricted data from the corresponding specific data and then sends the data to the server (step S45). At this time, the transmission control unit 335 does not need to send to the server 5 any restricted data that cannot be degraded in terms of information accuracy. The transmission control unit 335 also sends data other than restricted data to the server 5 as is without processing. After the processing in steps S43 to S45 has been performed for all of the multiple specific data identified in step S42, the transmission process is terminated.

[0096] Second Embodiment Next, the data acquisition system 1 according to the second embodiment will be described with reference to Figures 11 and 12. The configuration and operation of the data acquisition system 1 according to the second embodiment are basically the same as those of the data acquisition system 1 according to the first embodiment. The following description will focus on the differences from the data acquisition system 1 according to the first embodiment.

[0097] In the first embodiment described above, the transmission control unit 335 controlled the transmission of previously acquired data to the server 5 based on whether the user of vehicle 2 had consented to the provision of the data to an external party at the time the data was acquired. In this embodiment, the transmission control unit 335 controls the transmission of previously acquired data to the server 5 based on whether the user of vehicle 2 has consented to the provision of the data to an external party when the conditions for providing the data to the server 5 are met (i.e., when the data is transmitted to the server 5), in addition to the time the data was acquired. By controlling the transmission of data to the server 5 based on the user's consent status at the time of data acquisition as well as the consent status at the time of providing the data to an external party, it is possible to make a more careful decision regarding the transmission of data containing privacy information to the outside of vehicle 2.

[0098] More specifically, in this embodiment as well, if the transmission control unit 335 determines, by referring to the consent period information, that the user of vehicle 2 had not consented to the provision of the data to an external party at the time the data was acquired, it will not transmit the restrictive data, which is part of that data, to the server 5. Therefore, in this embodiment, in such a case, the transmission control unit 335 transmits the data other than the restrictive data from the target data to the server 5.

[0099] On the other hand, in this embodiment, even if the transmission control unit 335 determines that the user of vehicle 2 consented to the provision of data to an external party at the time the data was acquired by referring to the consent period information, if the consent information at the time of provision, which indicates whether the user of vehicle 2 consented to the provision of data to an external party when the data provision conditions were met, indicates that the user of vehicle 2 did not consent to the provision of data to an external party when the data provision conditions were met, the transmission control unit 335 will not send the restricted data, which is part of that data, to the server 5. Therefore, in this embodiment, even in such a case, the transmission control unit 335 sends the data other than the restricted data from the target data to the server 5.

[0100] In this embodiment, the transmission control unit 335 determines, by referring to the consent period information, that the user of vehicle 2 had consented to the provision of the data to an external party at the time the data was acquired, and if the consent information at the time of provision indicates that the user of vehicle 2 had consented to the provision of the data to an external party when the data provision conditions were met, then transmits all of the data (including the regulatory data) to the server 5.

[0101] In this way, by controlling the transmission of regulated data to server 5 depending on whether the user has consented to the external provision of the data when the data provision conditions are met, even if the user consented to the external provision of the data at the time the data was acquired, if they later change their mind and no longer consent to the external provision of the data, the transmission of the data to server 5 is suppressed.

[0102] In particular, in this embodiment, consent is determined for each user. Therefore, the transmission control unit 335 determines whether the user who acquired the data also consented to the provision of the data to an external party when the data provision conditions were met.

[0103] Therefore, in this embodiment, the data storage control unit 334 stores in the vehicle storage unit 32 the user of vehicle 2 at the time the data was acquired, in addition to the data acquired in vehicle 2. In particular, in this embodiment, the data storage control unit 334 stores in the vehicle storage unit 32 the current driver identified by the driver identification unit 331 or their information as the user of vehicle 2 at the time the data was acquired. The information of the current driver may be a feature quantity extracted from the driver's facial image, as described above.

[0104] Figure 11 is a diagram similar to Figure 5, showing an example of stored data stored in the vehicle storage unit 32 by the data storage control unit 334 in this embodiment. As shown in Figure 11, in this embodiment, each stored data stored in association with each data ID includes user data about the user of the vehicle 2, in addition to the data shown in Figure 5.

[0105] When the data provision conditions are met, the transmission control unit 335 transmits the stored data to the server 5 according to the consent period information if the user data contained in each stored data indicates that the user has consented to the provision of the data to an external party. On the other hand, when the data provision conditions are met, the transmission control unit 335 does not transmit the stored data to the server 5 if the user data contained in each stored data indicates that the user has not consented to the provision of the data to an external party.

[0106] By determining consent for each user in this way, it is possible to prevent data from being provided to server 5 if a user different from the user at the time the data was acquired consented to the provision of data to an external party when the data provision conditions were met. In this embodiment, user data is included in each stored data. However, the consent period information may include the user of vehicle 2 during each period, in addition to the periods during which the provision of data to an external party was consented to and periods during which it was not consented to.

[0107] Figure 12 is a flowchart similar to Figure 9, showing the flow of the transmission process according to this embodiment. Steps S51 to S53, S55, and S56 in Figure 12 are the same as steps S31 to S35 in Figure 9, so their explanation is omitted.

[0108] If it is determined in step S53 that the user had consented to the provision of the data to an external party at the time the corresponding specific data was acquired, the transmission control unit 335 determines whether the user at the time the specific data was acquired now consents to the provision of the data to an external party (step S54). Whether the user now consents to the provision of the data to an external party is determined based on the consent information transmitted from the consent information management unit 332. If it is determined in step S54 that the corresponding user now consents to the provision of the data to an external party, the transmission control unit 335 transmits all of the target specific data (including the restricted data) to the server 5 (step S55). On the other hand, if it is determined in step S54 that the corresponding user now does not consent to the provision of the data to an external party, the transmission control unit 335 transmits the data other than the restricted data from the target specific data to the server (step S56). Note that in step S56, the transmission control unit 335 transmits the data other than the restricted data from the target specific data to the server, but it is not necessary to transmit all of the target specific data to the server.

[0109] <Variation> Next, a modified version of the second embodiment will be described. In the modified version of the second embodiment, similar to the modified version of the first embodiment, if it is determined that the user of vehicle 2 did not consent to the provision of the data to an external party at the time the data was acquired, the transmission control unit 335 processes the regulatory data to reduce its accuracy before sending it to the server 5, and also sends data other than the regulatory data to the server 5 without processing it.

[0110] In addition, in this modified example, even if it is determined that the user of vehicle 2 had consented to the provision of the data to an external party at the time the data was acquired, if the consent information at the time of provision indicates that the user of vehicle 2 did not consent to the provision of the data to an external party at the time the data provision conditions were met, the transmission control unit 335 will send the restricted data to the server 5 after processing it to reduce the accuracy of the information, and will send the data other than the restricted data to the server 5 without processing it.

[0111] By processing the information in this way to reduce its accuracy before sending it to server 5, it is possible to provide the minimum necessary data used for analyzing the driving of vehicle 2, etc., while protecting the privacy of users who have not consented to the provision of their data to external parties.

[0112] While preferred embodiments of the present disclosure have been described above, the present disclosure is not limited to these embodiments, and various modifications and changes can be made within the scope of the claims. [Explanation of Symbols]

[0113] 1. Data Acquisition System 2 vehicles 5 Servers 10 sensors 30 ECU 33 Vehicle Processor

Claims

1. An information processing device mounted on a vehicle, A storage control unit that stores consent period information regarding the period during which the user of the vehicle consented to the provision of data acquired in the vehicle to an external party in the vehicle's storage unit, An information processing device comprising: a transmission control unit that controls the transmission of data previously acquired in the vehicle to an external device based on whether the user consented to the provision of the data to an external party at the time the data was acquired, by referring to the consent period information.

2. The information processing apparatus according to claim 1, wherein when the storage control unit stores data acquired in the vehicle in the storage unit, it also stores data representing the time the data was acquired in the storage unit.

3. The information processing apparatus according to claim 1 or 2, wherein the transmission control unit controls the transmission of previously acquired data to the external device when a data provision condition to the external device is met that is different from the condition when the data was acquired.

4. The information processing apparatus according to claim 3, wherein the transmission control unit controls the transmission of data previously acquired in the vehicle to the external device based on whether the user consented to the provision of the data to an external party at the time the data was acquired, and whether the user of the vehicle consented to the provision of the data to an external party when the conditions for providing the data to the external device are met.

5. The information processing apparatus according to claim 1, wherein if the transmission control unit determines, by referring to the consent period information, that the user of the vehicle did not consent to the provision of the data to an external device at the time the data was acquired, it does not transmit the regulatory data, which is at least a part of the data, to the external device.

6. The information processing apparatus according to claim 1, wherein if the transmission control unit determines, by referring to the consent period information, that the user of the vehicle did not consent to the provision of the data to an external party at the time the data was acquired, it transmits the regulatory data, which is at least a part of the data, to the external device after processing it to reduce the accuracy of the information.

7. The information processing apparatus according to claim 5 or 6, wherein the transmission control unit, by referring to the consent period information, determines that the user of the vehicle had consented to the provision of the data to an external device at the time the data was acquired, and transmits the data, including the regulatory data, to the external device.

8. The information processing apparatus according to claim 5 or 6, wherein even if the transmission control unit determines, by referring to the consent period information, that the user of the vehicle consented to the provision of the data to an external device at the time the data was acquired, if the consent information at the time of provision, which indicates whether the user of the vehicle consented to the provision of the data to an external device when different data provision conditions to the external device are met than those at the time the data was acquired, the transmission control unit does not transmit the restrictive data to the external device.

9. The information processing apparatus according to claim 5 or 6, wherein the transmission control unit determines, by referring to the consent period information, that the user of the vehicle had consented to the provision of the data to an external device at the time the data was acquired, but if the consent information at the time of provision, which indicates whether the user of the vehicle has consented to the provision of the data to an external device when different data provision conditions to the external device are met than when the data was acquired, indicates that the user of the vehicle has not consented to the provision of the data to an external device, the transmission control unit processes the restricted data to reduce the accuracy of the information and then transmits it to the external device.

10. The information processing apparatus according to claim 8, wherein the transmission control unit determines, by referring to the consent period information, that the user of the vehicle consented to the provision of the data to an external party at the time the data was acquired, and if the consent information at the time of provision indicates that the user of the vehicle consented to the provision of the data to an external party, the transmission control unit transmits the data, including the regulatory data, to the external device.

11. The information processing apparatus according to claim 6, wherein the processing that reduces the accuracy of the aforementioned information includes a process of anonymizing the privacy information contained in the regulated data.

12. The information processing apparatus according to claim 5 or 6, wherein the regulatory data includes privacy information of the user of the vehicle or a person who was around the vehicle at the time the data was acquired.

13. The information processing apparatus according to claim 1 or 2, further comprising a consent information management unit for managing consent information indicating whether or not the user of the vehicle consents to the provision of data to an external party.

14. The information processing apparatus according to claim 3, wherein the data provision conditions include conditions that are met when a data read request is received from the external device.

15. The information processing apparatus according to claim 3, wherein the data provision conditions include conditions that are met periodically.

16. The information processing device according to claim 3, wherein the data provision conditions include conditions that are met when a predetermined incident occurs in the vehicle.

17. A method of information processing performed in a vehicle, The vehicle's memory unit is used to store consent period information regarding the period during which the user of the vehicle consented to the provision of data acquired in the vehicle to external parties. An information processing method comprising controlling the transmission of data previously acquired in the vehicle to an external device based on whether the user consented to the provision of the data to an external party at the time the data was acquired, by referring to the consent period information.

18. A computer program executed in a vehicle, The vehicle's memory unit is used to store consent period information regarding the period during which the user of the vehicle consented to the provision of data acquired in the vehicle to external parties. The transmission of data previously acquired in the aforementioned vehicle to an external device is controlled based on whether the user consented to the provision of the data to an external party at the time the data was acquired, by referring to the consent period information. A computer program that causes a computer to execute something.

Images